Skip to content

Latest commit

 

History

History
116 lines (95 loc) · 11.7 KB

attack-tree.md

File metadata and controls

116 lines (95 loc) · 11.7 KB

Attack Tree Analysis for fasterxml/jackson-core

Objective: Achieve Unauthorized Access and Control over the Application by Exploiting Vulnerabilities in Jackson-core's JSON Processing.

Attack Tree Visualization

High-Risk Attack Paths and Critical Nodes:

└─── 1. Exploit Jackson-core Vulnerabilities (High-Risk Path) ├─── 1.1. Exploit Deserialization Vulnerabilities (High-Risk Path) │ ├─── 1.1.1. Remote Code Execution (RCE) via Polymorphic Deserialization (Critical Node, High-Risk Path) │ │ ├─── 1.1.1.2. Detect Jackson's Polymorphic Type Handling (Critical Node) │ │ ├─── 1.1.1.3. Identify Gadget Classes on Classpath (Critical Node) │ │ └─── 1.1.1.5. Application Executes Malicious Code (Critical Node, High-Risk Path) │ ├─── 1.1.2. Denial of Service (DoS) via Deserialization (High-Risk Path) │ │ └─── 1.1.2.3. Application Becomes Unresponsive or Crashes (Critical Node, High-Risk Path) ├─── 1.2. Exploit Parsing Vulnerabilities │ ├─── 1.2.1. Denial of Service (DoS) via Parser Exploits (High-Risk Path) │ │ └─── 1.2.1.3. Parser Consumes Excessive Resources (Critical Node, High-Risk Path) ├─── 1.3. Exploit Configuration or Usage Issues (High-Risk Path) │ ├─── 1.3.1. Misconfiguration of Jackson Features (Critical Node, High-Risk Path) │ │ ├─── 1.3.1.1. Default Typing Enabled Unnecessarily (Critical Node, High-Risk Path) │ │ │ └─── 1.3.1.1.1. Application uses ObjectMapper.enableDefaultTyping() without careful consideration (Critical Node, High-Risk Path) │ │ ├─── 1.3.1.3. Ignoring Security Best Practices (Critical Node, High-Risk Path) │ │ │ └─── 1.3.1.3.1. Not updating Jackson-core to latest versions with security patches (Critical Node, High-Risk Path) │ └─── 1.3.2. Application Logic Vulnerabilities Exposed by Jackson (High-Risk Path) │ └─── 1.3.2.1. Improper Handling of Deserialized Data (Critical Node, High-Risk Path) │ ├─── 1.3.2.1.1. Blindly Trusting Deserialized Data without Validation (Critical Node, High-Risk Path) │ ├─── 1.3.2.1.2. Using Deserialized Data in Security-Sensitive Operations (Critical Node, High-Risk Path) │ └─── 1.3.2.1.3. Lack of Input Sanitization after Deserialization (Critical Node, High-Risk Path)

Attack Tree Path: 1. Exploit Jackson-core Vulnerabilities (High-Risk Path):

  • Attack Vector: This is the top-level category encompassing all direct exploitation attempts targeting Jackson-core itself.
  • Risk: High, as vulnerabilities within Jackson-core can directly lead to application compromise.

Attack Tree Path: 2. Exploit Deserialization Vulnerabilities (High-Risk Path):

  • Attack Vector: Focuses on exploiting weaknesses in Jackson-core's deserialization process, which converts JSON data into Java objects.
  • Risk: Very High, deserialization vulnerabilities, especially in Java, are a well-known and potent attack vector.

Attack Tree Path: 3. Remote Code Execution (RCE) via Polymorphic Deserialization (Critical Node, High-Risk Path):

  • Attack Vector: Exploits Jackson's polymorphic deserialization feature, often enabled by default typing or annotations. Attackers inject malicious class names into JSON data. When Jackson deserializes this, it instantiates these classes, leading to code execution if vulnerable "gadget" classes are present on the application's classpath.
  • Risk: Critical, RCE allows attackers to gain complete control over the application server.
  • Critical Sub-Nodes:
    • 1.1.1.2. Detect Jackson's Polymorphic Type Handling (Critical Node):
      • Attack Vector: Attackers need to identify if the application uses polymorphic deserialization. This can be done by observing request/response patterns, looking for type hints in JSON (like @class, @type), or through code inspection if possible.
      • Risk: Medium, successful detection is a prerequisite for RCE via deserialization.
    • 1.1.1.3. Identify Gadget Classes on Classpath (Critical Node):
      • Attack Vector: Attackers need to determine if vulnerable "gadget" classes (like those in Commons Collections, Spring, etc.) are present in the application's classpath. This can be done through dependency analysis, error message analysis, or classpath probing if possible.
      • Risk: Medium, presence of gadget classes is necessary for exploiting known deserialization vulnerabilities for RCE.
    • 1.1.1.5. Application Executes Malicious Code (Critical Node, High-Risk Path):
      • Attack Vector: This is the successful outcome of the RCE attack. The application executes code provided by the attacker through the malicious JSON payload.
      • Risk: Critical, this is the point of full compromise.

Attack Tree Path: 4. Denial of Service (DoS) via Deserialization (High-Risk Path):

  • Attack Vector: Crafting JSON payloads that are designed to be computationally expensive to deserialize. This can involve deeply nested objects, extremely large objects, or recursive object structures.
  • Risk: High, DoS can disrupt application availability and impact business operations.
  • Critical Sub-Node:
    • 1.1.2.3. Application Becomes Unresponsive or Crashes (Critical Node, High-Risk Path):
      • Attack Vector: This is the outcome of a successful DoS attack. The application becomes unresponsive or crashes due to resource exhaustion during deserialization.
      • Risk: Medium to High, depending on the criticality of the application's availability.

Attack Tree Path: 5. Denial of Service (DoS) via Parser Exploits (High-Risk Path):

  • Attack Vector: Sending malformed or excessively complex JSON payloads designed to exploit vulnerabilities in Jackson-core's JSON parsing logic. This can lead to parser exceptions, infinite loops, or excessive resource consumption by the parser itself.
  • Risk: Medium to High, DoS can disrupt application availability.
  • Critical Sub-Node:
    • 1.2.1.3. Parser Consumes Excessive Resources (Critical Node, High-Risk Path):
      • Attack Vector: The Jackson-core parser consumes excessive CPU or memory resources while attempting to parse a malicious JSON payload, leading to DoS.
      • Risk: Medium to High, depending on the severity of resource exhaustion and impact on application performance.

Attack Tree Path: 6. Exploit Configuration or Usage Issues (High-Risk Path):

  • Attack Vector: This category focuses on vulnerabilities arising from how developers configure and use Jackson-core, rather than flaws in Jackson-core itself. Misconfigurations and improper usage are common sources of security issues.
  • Risk: High, misconfiguration and improper usage can directly introduce critical vulnerabilities.

Attack Tree Path: 7. Misconfiguration of Jackson Features (Critical Node, High-Risk Path):

  • Attack Vector: Incorrectly configuring Jackson-core, especially enabling insecure features like default typing without understanding the security implications.
  • Risk: Very High, misconfiguration is a major root cause of deserialization vulnerabilities.
  • Critical Sub-Nodes:
    • 1.3.1.1. Default Typing Enabled Unnecessarily (Critical Node, High-Risk Path):
      • Attack Vector: The application enables default typing using ObjectMapper.enableDefaultTyping() without a strong security justification and proper safeguards. This directly enables polymorphic deserialization vulnerabilities.
      • Risk: Critical, default typing is a well-known enabler of RCE vulnerabilities.
      • 1.3.1.1.1. Application uses ObjectMapper.enableDefaultTyping() without careful consideration (Critical Node, High-Risk Path):
        • Attack Vector: This is the code-level manifestation of the misconfiguration. Developers use enableDefaultTyping() without fully understanding the security risks.
        • Risk: Critical, direct code-level misconfiguration leading to high vulnerability.
    • 1.3.1.3. Ignoring Security Best Practices (Critical Node, High-Risk Path):
      • Attack Vector: Failing to follow security best practices related to Jackson-core, such as not keeping it updated with security patches.
      • Risk: Medium to High, neglecting security best practices increases the likelihood of exploitation of known vulnerabilities.
      • 1.3.1.3.1. Not updating Jackson-core to latest versions with security patches (Critical Node, High-Risk Path):
        • Attack Vector: Using outdated versions of Jackson-core that contain known security vulnerabilities that have been patched in later versions.
        • Risk: Medium to High, depending on the severity of the vulnerabilities in the outdated version.

Attack Tree Path: 8. Application Logic Vulnerabilities Exposed by Jackson (High-Risk Path):

  • Attack Vector: Vulnerabilities in the application's code that processes data deserialized by Jackson-core. Even with secure Jackson configuration, flaws in application logic can be exploited.
  • Risk: High, application logic vulnerabilities are common and can be easily overlooked.
  • Critical Sub-Node:
    • 1.3.2.1. Improper Handling of Deserialized Data (Critical Node, High-Risk Path):
      • Attack Vector: The application does not properly validate or sanitize data after it has been deserialized by Jackson-core. This can lead to various vulnerabilities depending on how the data is used.
      • Risk: High, improper data handling is a common source of vulnerabilities.
      • Critical Sub-Sub-Nodes:
        • 1.3.2.1.1. Blindly Trusting Deserialized Data without Validation (Critical Node, High-Risk Path):
          • Attack Vector: The application assumes that deserialized data is safe and trustworthy without performing any validation.
          • Risk: High, blindly trusting external input is a fundamental security flaw.
        • 1.3.2.1.2. Using Deserialized Data in Security-Sensitive Operations (Critical Node, High-Risk Path):
          • Attack Vector: Using deserialized data directly in security-sensitive operations, such as constructing file paths, executing commands, or making access control decisions, without proper validation and sanitization.
          • Risk: Critical, this can lead to severe vulnerabilities like file system traversal, command injection, and access control bypass.
        • 1.3.2.1.3. Lack of Input Sanitization after Deserialization (Critical Node, High-Risk Path):
          • Attack Vector: Failing to sanitize deserialized data to remove or neutralize potentially malicious content before using it in application logic.
          • Risk: High, lack of sanitization can allow malicious data to trigger vulnerabilities in subsequent processing steps.